From 30152841239809bf6347d0bd0f65836a35c23714 Mon Sep 17 00:00:00 2001
From: kloud-bot <ws@kloud.email>
Date: Wed, 25 Feb 2026 17:27:46 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=94=84=20Sync=20shared=20files=20from=20`?=
 =?UTF-8?q?ws-meta`?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 charts/workspace/scripts/env.reference.yaml | 51 +++++++++++++++++----
 1 file changed, 42 insertions(+), 9 deletions(-)

diff --git a/charts/workspace/scripts/env.reference.yaml b/charts/workspace/scripts/env.reference.yaml
index ea2e7da..f19da23 100644
--- a/charts/workspace/scripts/env.reference.yaml
+++ b/charts/workspace/scripts/env.reference.yaml
@@ -191,49 +191,49 @@ envs:
         type: boolean
         default: false
         since: 0.1.3
-        reference: /editor/claude
+        reference: /tools/claude
         description: Disables the Claude Code statusline.
 
       statusline_hide_context_bar:
         type: boolean
         default: false
         since: 0.1.3
-        reference: /editor/claude
+        reference: /tools/claude
         description: Hides the context usage bar in the Claude statusline.
 
       statusline_hide_git:
         type: boolean
         default: false
         since: 0.1.3
-        reference: /editor/claude
+        reference: /tools/claude
         description: Hides git branch and status in the Claude statusline.
 
       statusline_hide_lines_changed:
         type: boolean
         default: false
         since: 0.1.3
-        reference: /editor/claude
+        reference: /tools/claude
         description: Hides lines added/removed in the Claude statusline.
 
       statusline_hide_model:
         type: boolean
         default: false
         since: 0.1.3
-        reference: /editor/claude
+        reference: /tools/claude
         description: Hides the model name in the Claude statusline.
 
       statusline_script:
         type: string
         default: /etc/claude-code/statusline.zsh
         since: 0.1.3
-        reference: /editor/claude
+        reference: /tools/claude
         description: Path to the statusline script.
 
       statusline_shell:
         type: string
         default: zsh
         since: 0.1.3
-        reference: /editor/claude
+        reference: /tools/claude
         description: Shell used to execute the statusline script.
 
   docker:
@@ -746,11 +746,44 @@ envs:
         type: string
         default: >-
           1password auto-venv docker encode64 fzf-history git
-          golang helm kubectl npm python pip ssh-agent yarn
-          zsh-autosuggestions
+          golang helm kubectl npm python pip safe-history
+          ssh-agent yarn zsh-autosuggestions
         example: kubectl npm python pip
         description: Enables built-in `oh-my-zsh` plugins.
 
+      safe_history_ignore_failed:
+        type: boolean
+        default: true
+        reference: /editor/terminal
+        description: Prevents failed commands from being persisted to history file.
+        longDescription: |
+          When `true`, commands that exit with a non-zero status are kept in the
+          current session's history *(accessible via up-arrow)* but are **not**
+          written to `$HISTFILE`.
+
+          Only successful commands are persisted across sessions.
+
+      safe_history_ignore_secrets:
+        type: boolean
+        default: true
+        reference: /editor/terminal
+        description: Prevents commands containing secrets from entering history.
+        longDescription: |
+          When `true`, commands matching built-in secret patterns
+          *(e.g. `TOKEN=...`, `--password=...`, `Authorization:` headers, `curl -u`)*
+          are blocked entirely, they don't appear in the session history or on disk.
+
+      safe_history_secret_patterns:
+        type: string
+        default: null
+        reference: /editor/terminal
+        description: Additional pipe-delimited regex patterns treated as secrets.
+        longDescription: |
+          Accepts a **pipe-delimited** list of regex patterns appended to the
+          built-in secret patterns. Commands matching any pattern are excluded
+          from history entirely.
+        example: my-corp-token|INTERNAL_KEY=
+
 deprecated:
   WS_APT_UPDATE_REPOS:
     use: WS_APT_UPDATE_CACHE